projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Make SMP context private to smp.c
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
17b02e62 34#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 35
065a13e2
JH		 36#define AUTH_REQ_MASK 0x07
37
4bc58f51
JH		 38#define SMP_FLAG_TK_VALID 1
39#define SMP_FLAG_CFM_PENDING 2
40#define SMP_FLAG_MITM_AUTH 3
41#define SMP_FLAG_COMPLETE 4
42#define SMP_FLAG_INITIATOR 5
43
44struct smp_chan {
45 struct l2cap_conn *conn;
46 u8 preq[7]; /* SMP Pairing Request */
47 u8 prsp[7]; /* SMP Pairing Response */
48 u8 prnd[16]; /* SMP Pairing Random (local) */
49 u8 rrnd[16]; /* SMP Pairing Random (remote) */
50 u8 pcnf[16]; /* SMP Pairing Confirm */
51 u8 tk[16]; /* SMP Temporary Key */
52 u8 enc_key_size;
53 u8 remote_key_dist;
54 bdaddr_t id_addr;
55 u8 id_addr_type;
56 u8 irk[16];
57 struct smp_csrk *csrk;
58 struct smp_csrk *slave_csrk;
59 struct smp_ltk *ltk;
60 struct smp_ltk *slave_ltk;
61 struct smp_irk *remote_irk;
62 unsigned long smp_flags;
63 struct work_struct confirm;
64 struct work_struct random;
65};
66
66bed1a2 67static inline void swap128(const u8 src[16], u8 dst[16])
d22ef0bc
AB		 68{
69 int i;
70 for (i = 0; i < 16; i++)
71 dst[15 - i] = src[i];
72}
73
66bed1a2 74static inline void swap56(const u8 src[7], u8 dst[7])
d22ef0bc
AB		 75{
76 int i;
77 for (i = 0; i < 7; i++)
78 dst[6 - i] = src[i];
79}
80
81static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
82{
83 struct blkcipher_desc desc;
84 struct scatterlist sg;
943a732a 85 uint8_t tmp[16], data[16];
201a5929 86 int err;
d22ef0bc
AB		 87
88 if (tfm == NULL) {
89 BT_ERR("tfm %p", tfm);
90 return -EINVAL;
91 }
92
93 desc.tfm = tfm;
94 desc.flags = 0;
95
943a732a
JH		 96 /* The most significant octet of key corresponds to k[0] */
97 swap128(k, tmp);
98
99 err = crypto_blkcipher_setkey(tfm, tmp, 16);
d22ef0bc
AB		 100 if (err) {
101 BT_ERR("cipher setkey failed: %d", err);
102 return err;
103 }
104
943a732a
JH		 105 /* Most significant octet of plaintextData corresponds to data[0] */
106 swap128(r, data);
107
108 sg_init_one(&sg, data, 16);
d22ef0bc 109
d22ef0bc
AB		 110 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
111 if (err)
112 BT_ERR("Encrypt data error %d", err);
113
943a732a
JH		 114 /* Most significant octet of encryptedData corresponds to data[0] */
115 swap128(data, r);
116
d22ef0bc
AB		 117 return err;
118}
119
60478054
JH		 120static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
121{
943a732a 122 u8 _res[16];
60478054
JH		 123 int err;
124
125 /* r' = padding || r */
943a732a
JH		 126 memcpy(_res, r, 3);
127 memset(_res + 3, 0, 13);
60478054 128
943a732a 129 err = smp_e(tfm, irk, _res);
60478054
JH		 130 if (err) {
131 BT_ERR("Encrypt error");
132 return err;
133 }
134
135 /* The output of the random address function ah is:
136 * ah(h, r) = e(k, r') mod 2^24
137 * The output of the security function e is then truncated to 24 bits
138 * by taking the least significant 24 bits of the output of e as the
139 * result of ah.
140 */
943a732a 141 memcpy(res, _res, 3);
60478054
JH		 142
143 return 0;
144}
145
146bool smp_irk_matches(struct crypto_blkcipher *tfm, u8 irk[16],
147 bdaddr_t *bdaddr)
148{
149 u8 hash[3];
150 int err;
151
152 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
153
154 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
155 if (err)
156 return false;
157
158 return !memcmp(bdaddr->b, hash, 3);
159}
160
b1e2b3ae
JH		 161int smp_generate_rpa(struct crypto_blkcipher *tfm, u8 irk[16], bdaddr_t *rpa)
162{
163 int err;
164
165 get_random_bytes(&rpa->b[3], 3);
166
167 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
168 rpa->b[5] |= 0x40; /* Set second most significant bit */
169
170 err = smp_ah(tfm, irk, &rpa->b[3], rpa->b);
171 if (err < 0)
172 return err;
173
174 BT_DBG("RPA %pMR", rpa);
175
176 return 0;
177}
178
d22ef0bc 179static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
f1560463
MH		 180 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
181 u8 _rat, bdaddr_t *ra, u8 res[16])
d22ef0bc
AB		 182{
183 u8 p1[16], p2[16];
184 int err;
185
186 memset(p1, 0, 16);
187
188 /* p1 = pres || preq || _rat || _iat */
943a732a
JH		 189 p1[0] = _iat;
190 p1[1] = _rat;
191 memcpy(p1 + 2, preq, 7);
192 memcpy(p1 + 9, pres, 7);
d22ef0bc
AB		 193
194 /* p2 = padding || ia || ra */
943a732a
JH		 195 memcpy(p2, ra, 6);
196 memcpy(p2 + 6, ia, 6);
197 memset(p2 + 12, 0, 4);
d22ef0bc
AB		 198
199 /* res = r XOR p1 */
200 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
201
202 /* res = e(k, res) */
203 err = smp_e(tfm, k, res);
204 if (err) {
205 BT_ERR("Encrypt data error");
206 return err;
207 }
208
209 /* res = res XOR p2 */
210 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
211
212 /* res = e(k, res) */
213 err = smp_e(tfm, k, res);
214 if (err)
215 BT_ERR("Encrypt data error");
216
217 return err;
218}
219
f1560463
MH		 220static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16], u8 r1[16],
221 u8 r2[16], u8 _r[16])
d22ef0bc
AB		 222{
223 int err;
224
225 /* Just least significant octets from r1 and r2 are considered */
943a732a
JH		 226 memcpy(_r, r2, 8);
227 memcpy(_r + 8, r1, 8);
d22ef0bc
AB		 228
229 err = smp_e(tfm, k, _r);
230 if (err)
231 BT_ERR("Encrypt data error");
232
233 return err;
234}
235
eb492e01 236static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
f1560463 237 u16 dlen, void *data)
eb492e01
AB		 238{
239 struct sk_buff *skb;
240 struct l2cap_hdr *lh;
241 int len;
242
243 len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
244
245 if (len > conn->mtu)
246 return NULL;
247
248 skb = bt_skb_alloc(len, GFP_ATOMIC);
249 if (!skb)
250 return NULL;
251
252 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
253 lh->len = cpu_to_le16(sizeof(code) + dlen);
dcf4adbf 254 lh->cid = cpu_to_le16(L2CAP_CID_SMP);
eb492e01
AB		 255
256 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
257
258 memcpy(skb_put(skb, dlen), data, dlen);
259
260 return skb;
261}
262
263static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
264{
265 struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
266
267 BT_DBG("code 0x%2.2x", code);
268
269 if (!skb)
270 return;
271
73d80deb
LAD		 272 skb->priority = HCI_PRIO_MAX;
273 hci_send_acl(conn->hchan, skb, 0);
e2dcd113 274
6c9d42a1 275 cancel_delayed_work_sync(&conn->security_timer);
17b02e62 276 schedule_delayed_work(&conn->security_timer, SMP_TIMEOUT);
eb492e01
AB		 277}
278
2b64d153
BG		 279static __u8 authreq_to_seclevel(__u8 authreq)
280{
281 if (authreq & SMP_AUTH_MITM)
282 return BT_SECURITY_HIGH;
283 else
284 return BT_SECURITY_MEDIUM;
285}
286
287static __u8 seclevel_to_authreq(__u8 sec_level)
288{
289 switch (sec_level) {
290 case BT_SECURITY_HIGH:
291 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
292 case BT_SECURITY_MEDIUM:
293 return SMP_AUTH_BONDING;
294 default:
295 return SMP_AUTH_NONE;
296 }
297}
298
b8e66eac 299static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 300 struct smp_cmd_pairing *req,
301 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 302{
fd349c02
JH		 303 struct smp_chan *smp = conn->smp_chan;
304 struct hci_conn *hcon = conn->hcon;
305 struct hci_dev *hdev = hcon->hdev;
306 u8 local_dist = 0, remote_dist = 0;
54790f73 307
a8b2d5c2 308 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
7ee4ea36
MH		 309 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
310 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
54790f73 311 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 312 } else {
313 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 314 }
315
fd349c02
JH		 316 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
317 remote_dist |= SMP_DIST_ID_KEY;
318
863efaf2
JH		 319 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
320 local_dist |= SMP_DIST_ID_KEY;
321
54790f73
VCG		 322 if (rsp == NULL) {
323 req->io_capability = conn->hcon->io_capability;
324 req->oob_flag = SMP_OOB_NOT_PRESENT;
325 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 326 req->init_key_dist = local_dist;
327 req->resp_key_dist = remote_dist;
065a13e2 328 req->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 329
330 smp->remote_key_dist = remote_dist;
54790f73
VCG		 331 return;
332 }
333
334 rsp->io_capability = conn->hcon->io_capability;
335 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
336 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 337 rsp->init_key_dist = req->init_key_dist & remote_dist;
338 rsp->resp_key_dist = req->resp_key_dist & local_dist;
065a13e2 339 rsp->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 340
341 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 342}
343
3158c50c
VCG		 344static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
345{
1c1def09
VCG		 346 struct smp_chan *smp = conn->smp_chan;
347
3158c50c 348 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 349 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 350 return SMP_ENC_KEY_SIZE;
351
f7aa611a 352 smp->enc_key_size = max_key_size;
3158c50c
VCG		 353
354 return 0;
355}
356
84794e11 357static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 358{
bab73cb6
JH		 359 struct hci_conn *hcon = conn->hcon;
360
84794e11 361 if (reason)
4f957a76 362 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 363 &reason);
4f957a76 364
ce39fb4e
MH		 365 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
366 mgmt_auth_failed(hcon->hdev, &hcon->dst, hcon->type, hcon->dst_type,
367 HCI_ERROR_AUTH_FAILURE);
f1c09c07 368
61a0cfb0
AG		 369 cancel_delayed_work_sync(&conn->security_timer);
370
ce39fb4e 371 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
f1c09c07 372 smp_chan_destroy(conn);
4f957a76
BG		 373}
374
2b64d153
BG		 375#define JUST_WORKS 0x00
376#define JUST_CFM 0x01
377#define REQ_PASSKEY 0x02
378#define CFM_PASSKEY 0x03
379#define REQ_OOB 0x04
380#define OVERLAP 0xFF
381
382static const u8 gen_method[5][5] = {
383 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
384 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
385 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
386 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
387 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
388};
389
390static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
391 u8 local_io, u8 remote_io)
392{
393 struct hci_conn *hcon = conn->hcon;
394 struct smp_chan *smp = conn->smp_chan;
395 u8 method;
396 u32 passkey = 0;
397 int ret = 0;
398
399 /* Initialize key for JUST WORKS */
400 memset(smp->tk, 0, sizeof(smp->tk));
401 clear_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
402
403 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
404
405 /* If neither side wants MITM, use JUST WORKS */
406 /* If either side has unknown io_caps, use JUST WORKS */
407 /* Otherwise, look up method from the table */
408 if (!(auth & SMP_AUTH_MITM) ||
f1560463
MH		 409 local_io > SMP_IO_KEYBOARD_DISPLAY ||
410 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2b64d153
BG		 411 method = JUST_WORKS;
412 else
b3ff53ff 413 method = gen_method[remote_io][local_io];
2b64d153
BG		 414
415 /* If not bonding, don't ask user to confirm a Zero TK */
416 if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
417 method = JUST_WORKS;
418
a82505c7
JH		 419 /* Don't confirm locally initiated pairing attempts */
420 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR,
421 &smp->smp_flags))
422 method = JUST_WORKS;
423
2b64d153
BG		 424 /* If Just Works, Continue with Zero TK */
425 if (method == JUST_WORKS) {
426 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
427 return 0;
428 }
429
430 /* Not Just Works/Confirm results in MITM Authentication */
431 if (method != JUST_CFM)
432 set_bit(SMP_FLAG_MITM_AUTH, &smp->smp_flags);
433
434 /* If both devices have Keyoard-Display I/O, the master
435 * Confirms and the slave Enters the passkey.
436 */
437 if (method == OVERLAP) {
438 if (hcon->link_mode & HCI_LM_MASTER)
439 method = CFM_PASSKEY;
440 else
441 method = REQ_PASSKEY;
442 }
443
01ad34d2 444 /* Generate random passkey. */
2b64d153 445 if (method == CFM_PASSKEY) {
943a732a 446 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153
BG		 447 get_random_bytes(&passkey, sizeof(passkey));
448 passkey %= 1000000;
943a732a 449 put_unaligned_le32(passkey, smp->tk);
2b64d153 450 BT_DBG("PassKey: %d", passkey);
01ad34d2 451 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
2b64d153
BG		 452 }
453
454 hci_dev_lock(hcon->hdev);
455
456 if (method == REQ_PASSKEY)
ce39fb4e 457 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 458 hcon->type, hcon->dst_type);
4eb65e66
JH		 459 else if (method == JUST_CFM)
460 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
461 hcon->type, hcon->dst_type,
462 passkey, 1);
2b64d153 463 else
01ad34d2 464 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
272d90df 465 hcon->type, hcon->dst_type,
39adbffe 466 passkey, 0);
2b64d153
BG		 467
468 hci_dev_unlock(hcon->hdev);
469
470 return ret;
471}
472
8aab4757
VCG		 473static void confirm_work(struct work_struct *work)
474{
475 struct smp_chan *smp = container_of(work, struct smp_chan, confirm);
476 struct l2cap_conn *conn = smp->conn;
893ce8b1
JH		 477 struct hci_dev *hdev = conn->hcon->hdev;
478 struct crypto_blkcipher *tfm = hdev->tfm_aes;
8aab4757
VCG		 479 struct smp_cmd_pairing_confirm cp;
480 int ret;
943a732a 481 u8 reason;
8aab4757
VCG		 482
483 BT_DBG("conn %p", conn);
484
893ce8b1
JH		 485 /* Prevent mutual access to hdev->tfm_aes */
486 hci_dev_lock(hdev);
8aab4757 487
b1cd5fd9
JH		 488 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
489 conn->hcon->init_addr_type, &conn->hcon->init_addr,
943a732a
JH		 490 conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
491 cp.confirm_val);
893ce8b1
JH		 492
493 hci_dev_unlock(hdev);
494
8aab4757
VCG		 495 if (ret) {
496 reason = SMP_UNSPECIFIED;
497 goto error;
498 }
499
2b64d153
BG		 500 clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
501
8aab4757
VCG		 502 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
503
504 return;
505
506error:
84794e11 507 smp_failure(conn, reason);
8aab4757
VCG		 508}
509
510static void random_work(struct work_struct *work)
511{
512 struct smp_chan *smp = container_of(work, struct smp_chan, random);
513 struct l2cap_conn *conn = smp->conn;
514 struct hci_conn *hcon = conn->hcon;
893ce8b1
JH		 515 struct hci_dev *hdev = hcon->hdev;
516 struct crypto_blkcipher *tfm = hdev->tfm_aes;
943a732a 517 u8 reason, confirm[16];
8aab4757
VCG		 518 int ret;
519
520 if (IS_ERR_OR_NULL(tfm)) {
521 reason = SMP_UNSPECIFIED;
522 goto error;
523 }
524
525 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
526
893ce8b1
JH		 527 /* Prevent mutual access to hdev->tfm_aes */
528 hci_dev_lock(hdev);
529
b1cd5fd9
JH		 530 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
531 hcon->init_addr_type, &hcon->init_addr,
943a732a 532 hcon->resp_addr_type, &hcon->resp_addr, confirm);
893ce8b1
JH		 533
534 hci_dev_unlock(hdev);
535
8aab4757
VCG		 536 if (ret) {
537 reason = SMP_UNSPECIFIED;
538 goto error;
539 }
540
8aab4757
VCG		 541 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
542 BT_ERR("Pairing failed (confirmation values mismatch)");
543 reason = SMP_CONFIRM_FAILED;
544 goto error;
545 }
546
547 if (hcon->out) {
fe39c7b2
MH		 548 u8 stk[16];
549 __le64 rand = 0;
550 __le16 ediv = 0;
8aab4757 551
943a732a 552 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, stk);
8aab4757 553
f7aa611a 554 memset(stk + smp->enc_key_size, 0,
04124681 555 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 556
51a8efd7 557 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) {
8aab4757
VCG		 558 reason = SMP_UNSPECIFIED;
559 goto error;
560 }
561
562 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 563 hcon->enc_key_size = smp->enc_key_size;
8aab4757 564 } else {
943a732a 565 u8 stk[16];
fe39c7b2
MH		 566 __le64 rand = 0;
567 __le16 ediv = 0;
8aab4757 568
943a732a
JH		 569 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
570 smp->prnd);
8aab4757 571
943a732a 572 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, stk);
8aab4757 573
f7aa611a 574 memset(stk + smp->enc_key_size, 0,
f1560463 575 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 576
ce39fb4e 577 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
35d70271 578 HCI_SMP_STK_SLAVE, 0, stk, smp->enc_key_size,
04124681 579 ediv, rand);
8aab4757
VCG		 580 }
581
582 return;
583
584error:
84794e11 585 smp_failure(conn, reason);
8aab4757
VCG		 586}
587
588static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
589{
590 struct smp_chan *smp;
591
f1560463 592 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
8aab4757
VCG		 593 if (!smp)
594 return NULL;
595
596 INIT_WORK(&smp->confirm, confirm_work);
597 INIT_WORK(&smp->random, random_work);
598
599 smp->conn = conn;
600 conn->smp_chan = smp;
2b64d153 601 conn->hcon->smp_conn = conn;
8aab4757
VCG		 602
603 hci_conn_hold(conn->hcon);
604
605 return smp;
606}
607
608void smp_chan_destroy(struct l2cap_conn *conn)
609{
c8eb9690 610 struct smp_chan *smp = conn->smp_chan;
f4a407be 611 bool complete;
c8eb9690 612
f1c09c07 613 BUG_ON(!smp);
c8eb9690 614
f4a407be
JH		 615 complete = test_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
616 mgmt_smp_complete(conn->hcon, complete);
617
7ee4ea36
MH		 618 kfree(smp->csrk);
619 kfree(smp->slave_csrk);
620
759331d7
JH		 621 /* If pairing failed clean up any keys we might have */
622 if (!complete) {
623 if (smp->ltk) {
624 list_del(&smp->ltk->list);
625 kfree(smp->ltk);
626 }
627
628 if (smp->slave_ltk) {
629 list_del(&smp->slave_ltk->list);
630 kfree(smp->slave_ltk);
631 }
632
633 if (smp->remote_irk) {
634 list_del(&smp->remote_irk->list);
635 kfree(smp->remote_irk);
636 }
637 }
638
c8eb9690
BG		 639 kfree(smp);
640 conn->smp_chan = NULL;
2b64d153 641 conn->hcon->smp_conn = NULL;
76a68ba0 642 hci_conn_drop(conn->hcon);
8aab4757
VCG		 643}
644
2b64d153
BG		 645int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
646{
647 struct l2cap_conn *conn = hcon->smp_conn;
648 struct smp_chan *smp;
649 u32 value;
2b64d153
BG		 650
651 BT_DBG("");
652
653 if (!conn)
654 return -ENOTCONN;
655
656 smp = conn->smp_chan;
657
658 switch (mgmt_op) {
659 case MGMT_OP_USER_PASSKEY_REPLY:
660 value = le32_to_cpu(passkey);
943a732a 661 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153 662 BT_DBG("PassKey: %d", value);
943a732a 663 put_unaligned_le32(value, smp->tk);
2b64d153
BG		 664 /* Fall Through */
665 case MGMT_OP_USER_CONFIRM_REPLY:
666 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
667 break;
668 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
669 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 670 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 671 return 0;
672 default:
84794e11 673 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 674 return -EOPNOTSUPP;
675 }
676
677 /* If it is our turn to send Pairing Confirm, do so now */
678 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags))
679 queue_work(hcon->hdev->workqueue, &smp->confirm);
680
681 return 0;
682}
683
da85e5e5 684static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 685{
3158c50c 686 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
8aab4757 687 struct smp_chan *smp;
3158c50c 688 u8 key_size;
2b64d153 689 u8 auth = SMP_AUTH_NONE;
8aab4757 690 int ret;
88ba43b6
AB		 691
692 BT_DBG("conn %p", conn);
693
c46b98be 694 if (skb->len < sizeof(*req))
38e4a915 695 return SMP_INVALID_PARAMS;
c46b98be 696
2b64d153
BG		 697 if (conn->hcon->link_mode & HCI_LM_MASTER)
698 return SMP_CMD_NOTSUPP;
699
51a8efd7 700 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
8aab4757 701 smp = smp_chan_create(conn);
d08fd0e7
AE		 702 else
703 smp = conn->smp_chan;
8aab4757 704
d08fd0e7
AE		 705 if (!smp)
706 return SMP_UNSPECIFIED;
d26a2345 707
1c1def09
VCG		 708 smp->preq[0] = SMP_CMD_PAIRING_REQ;
709 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 710 skb_pull(skb, sizeof(*req));
88ba43b6 711
2b64d153
BG		 712 /* We didn't start the pairing, so match remote */
713 if (req->auth_req & SMP_AUTH_BONDING)
714 auth = req->auth_req;
da85e5e5 715
fdde0a26
IY		 716 conn->hcon->pending_sec_level = authreq_to_seclevel(auth);
717
2b64d153 718 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 719
720 key_size = min(req->max_key_size, rsp.max_key_size);
721 if (check_enc_key_size(conn, key_size))
722 return SMP_ENC_KEY_SIZE;
88ba43b6 723
e84a6b13 724 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 725
1c1def09
VCG		 726 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
727 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 728
3158c50c 729 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 730
2b64d153
BG		 731 /* Request setup of TK */
732 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
733 if (ret)
734 return SMP_UNSPECIFIED;
735
edca792c
JH		 736 clear_bit(SMP_FLAG_INITIATOR, &smp->smp_flags);
737
da85e5e5 738 return 0;
88ba43b6
AB		 739}
740
da85e5e5 741static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 742{
3158c50c 743 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1c1def09 744 struct smp_chan *smp = conn->smp_chan;
8aab4757 745 struct hci_dev *hdev = conn->hcon->hdev;
2b64d153 746 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 747 int ret;
88ba43b6
AB		 748
749 BT_DBG("conn %p", conn);
750
c46b98be 751 if (skb->len < sizeof(*rsp))
38e4a915 752 return SMP_INVALID_PARAMS;
c46b98be 753
2b64d153
BG		 754 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
755 return SMP_CMD_NOTSUPP;
756
3158c50c
VCG		 757 skb_pull(skb, sizeof(*rsp));
758
1c1def09 759 req = (void *) &smp->preq[1];
da85e5e5 760
3158c50c
VCG		 761 key_size = min(req->max_key_size, rsp->max_key_size);
762 if (check_enc_key_size(conn, key_size))
763 return SMP_ENC_KEY_SIZE;
764
e84a6b13 765 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 766
8aab4757
VCG		 767 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
768 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 769
fdcc4bec
JH		 770 /* Update remote key distribution in case the remote cleared
771 * some bits that we had enabled in our request.
772 */
773 smp->remote_key_dist &= rsp->resp_key_dist;
774
2b64d153 775 if ((req->auth_req & SMP_AUTH_BONDING) &&
f1560463 776 (rsp->auth_req & SMP_AUTH_BONDING))
2b64d153
BG		 777 auth = SMP_AUTH_BONDING;
778
779 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
780
476585ec 781 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 782 if (ret)
783 return SMP_UNSPECIFIED;
784
785 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
786
787 /* Can't compose response until we have been confirmed */
18e4aeb9
JH		 788 if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
789 queue_work(hdev->workqueue, &smp->confirm);
da85e5e5
VCG		 790
791 return 0;
88ba43b6
AB		 792}
793
da85e5e5 794static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 795{
1c1def09 796 struct smp_chan *smp = conn->smp_chan;
8aab4757 797 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 798
88ba43b6
AB		 799 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
800
c46b98be 801 if (skb->len < sizeof(smp->pcnf))
38e4a915 802 return SMP_INVALID_PARAMS;
c46b98be 803
1c1def09
VCG		 804 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
805 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 806
943a732a
JH		 807 if (conn->hcon->out)
808 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
809 smp->prnd);
810 else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
8aab4757 811 queue_work(hdev->workqueue, &smp->confirm);
943a732a 812 else
2b64d153 813 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
da85e5e5
VCG		 814
815 return 0;
88ba43b6
AB		 816}
817
da85e5e5 818static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 819{
1c1def09 820 struct smp_chan *smp = conn->smp_chan;
8aab4757 821 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 822
8aab4757 823 BT_DBG("conn %p", conn);
3158c50c 824
c46b98be 825 if (skb->len < sizeof(smp->rrnd))
38e4a915 826 return SMP_INVALID_PARAMS;
c46b98be 827
943a732a 828 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
8aab4757 829 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 830
8aab4757 831 queue_work(hdev->workqueue, &smp->random);
da85e5e5
VCG		 832
833 return 0;
88ba43b6
AB		 834}
835
4dab7864 836static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 837{
c9839a11 838 struct smp_ltk *key;
988c5997
VCG		 839 struct hci_conn *hcon = conn->hcon;
840
98a0b845
JH		 841 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
842 hcon->out);
988c5997
VCG		 843 if (!key)
844 return 0;
845
4dab7864
JH		 846 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
847 return 0;
848
51a8efd7 849 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
988c5997
VCG		 850 return 1;
851
c9839a11
VCG		 852 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
853 hcon->enc_key_size = key->enc_size;
988c5997
VCG		 854
855 return 1;
988c5997 856}
f1560463 857
da85e5e5 858static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 859{
860 struct smp_cmd_security_req *rp = (void *) skb->data;
861 struct smp_cmd_pairing cp;
f1cb9af5 862 struct hci_conn *hcon = conn->hcon;
8aab4757 863 struct smp_chan *smp;
88ba43b6
AB		 864
865 BT_DBG("conn %p", conn);
866
c46b98be 867 if (skb->len < sizeof(*rp))
38e4a915 868 return SMP_INVALID_PARAMS;
c46b98be 869
86ca9eac
JH		 870 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
871 return SMP_CMD_NOTSUPP;
872
2b64d153 873 hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
feb45eb5 874
4dab7864 875 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 876 return 0;
877
51a8efd7 878 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 879 return 0;
f1cb9af5 880
8aab4757 881 smp = smp_chan_create(conn);
d26a2345 882
88ba43b6 883 skb_pull(skb, sizeof(*rp));
88ba43b6 884
da85e5e5 885 memset(&cp, 0, sizeof(cp));
54790f73 886 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 887
1c1def09
VCG		 888 smp->preq[0] = SMP_CMD_PAIRING_REQ;
889 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 890
88ba43b6 891 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 892
edca792c
JH		 893 clear_bit(SMP_FLAG_INITIATOR, &smp->smp_flags);
894
da85e5e5 895 return 0;
88ba43b6
AB		 896}
897
ad32a2f5
JH		 898bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
899{
900 if (sec_level == BT_SECURITY_LOW)
901 return true;
902
903 if (hcon->sec_level >= sec_level)
904 return true;
905
906 return false;
907}
908
cc110922 909int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 910{
cc110922 911 struct l2cap_conn *conn = hcon->l2cap_data;
0a66cf20 912 struct smp_chan *smp;
2b64d153 913 __u8 authreq;
eb492e01 914
3a0259bb
VCG		 915 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
916
0a66cf20
JH		 917 /* This may be NULL if there's an unexpected disconnection */
918 if (!conn)
919 return 1;
920
757aee0f 921 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 922 return 1;
923
ad32a2f5 924 if (smp_sufficient_security(hcon, sec_level))
eb492e01 925 return 1;
f1cb9af5 926
988c5997 927 if (hcon->link_mode & HCI_LM_MASTER)
4dab7864 928 if (smp_ltk_encrypt(conn, sec_level))
02bc7455 929 goto done;
d26a2345 930
51a8efd7 931 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 932 return 0;
933
8aab4757 934 smp = smp_chan_create(conn);
2b64d153
BG		 935 if (!smp)
936 return 1;
937
938 authreq = seclevel_to_authreq(sec_level);
d26a2345 939
2e233644
JH		 940 /* hcon->auth_type is set by pair_device in mgmt.c. If the MITM
941 * flag is set we should also set it for the SMP request.
942 */
943 if ((hcon->auth_type & 0x01))
944 authreq |= SMP_AUTH_MITM;
945
d26a2345
VCG		 946 if (hcon->link_mode & HCI_LM_MASTER) {
947 struct smp_cmd_pairing cp;
f01ead31 948
2b64d153 949 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 950 smp->preq[0] = SMP_CMD_PAIRING_REQ;
951 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 952
eb492e01
AB		 953 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
954 } else {
955 struct smp_cmd_security_req cp;
2b64d153 956 cp.auth_req = authreq;
eb492e01
AB		 957 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
958 }
959
edca792c
JH		 960 set_bit(SMP_FLAG_INITIATOR, &smp->smp_flags);
961
61b3b2b6 962done:
f1cb9af5 963 hcon->pending_sec_level = sec_level;
f1cb9af5 964
eb492e01
AB		 965 return 0;
966}
967
7034b911
VCG		 968static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
969{
16b90839 970 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
1c1def09 971 struct smp_chan *smp = conn->smp_chan;
16b90839 972
c46b98be
JH		 973 BT_DBG("conn %p", conn);
974
975 if (skb->len < sizeof(*rp))
38e4a915 976 return SMP_INVALID_PARAMS;
c46b98be 977
6131ddc8
JH		 978 /* Ignore this PDU if it wasn't requested */
979 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
980 return 0;
981
16b90839
VCG		 982 skb_pull(skb, sizeof(*rp));
983
1c1def09 984 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 985
7034b911
VCG		 986 return 0;
987}
988
989static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
990{
16b90839 991 struct smp_cmd_master_ident *rp = (void *) skb->data;
1c1def09 992 struct smp_chan *smp = conn->smp_chan;
c9839a11
VCG		 993 struct hci_dev *hdev = conn->hcon->hdev;
994 struct hci_conn *hcon = conn->hcon;
23d0e128 995 struct smp_ltk *ltk;
c9839a11 996 u8 authenticated;
16b90839 997
c46b98be
JH		 998 BT_DBG("conn %p", conn);
999
1000 if (skb->len < sizeof(*rp))
38e4a915 1001 return SMP_INVALID_PARAMS;
c46b98be 1002
6131ddc8
JH		 1003 /* Ignore this PDU if it wasn't requested */
1004 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
1005 return 0;
1006
9747a9f3
JH		 1007 /* Mark the information as received */
1008 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
1009
16b90839 1010 skb_pull(skb, sizeof(*rp));
7034b911 1011
c9839a11 1012 hci_dev_lock(hdev);
ce39fb4e 1013 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
35d70271 1014 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, HCI_SMP_LTK,
23d0e128
JH		 1015 authenticated, smp->tk, smp->enc_key_size,
1016 rp->ediv, rp->rand);
1017 smp->ltk = ltk;
fd349c02 1018 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
4bd6d38e 1019 smp_distribute_keys(conn);
c9839a11 1020 hci_dev_unlock(hdev);
7034b911
VCG		 1021
1022 return 0;
1023}
1024
fd349c02
JH		 1025static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
1026{
1027 struct smp_cmd_ident_info *info = (void *) skb->data;
1028 struct smp_chan *smp = conn->smp_chan;
1029
1030 BT_DBG("");
1031
1032 if (skb->len < sizeof(*info))
38e4a915 1033 return SMP_INVALID_PARAMS;
fd349c02 1034
6131ddc8
JH		 1035 /* Ignore this PDU if it wasn't requested */
1036 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1037 return 0;
1038
fd349c02
JH		 1039 skb_pull(skb, sizeof(*info));
1040
1041 memcpy(smp->irk, info->irk, 16);
1042
1043 return 0;
1044}
1045
1046static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
1047 struct sk_buff *skb)
1048{
1049 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
1050 struct smp_chan *smp = conn->smp_chan;
1051 struct hci_conn *hcon = conn->hcon;
1052 bdaddr_t rpa;
1053
1054 BT_DBG("");
1055
1056 if (skb->len < sizeof(*info))
38e4a915 1057 return SMP_INVALID_PARAMS;
fd349c02 1058
6131ddc8
JH		 1059 /* Ignore this PDU if it wasn't requested */
1060 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1061 return 0;
1062
9747a9f3
JH		 1063 /* Mark the information as received */
1064 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
1065
fd349c02
JH		 1066 skb_pull(skb, sizeof(*info));
1067
a9a58f86
JH		 1068 /* Strictly speaking the Core Specification (4.1) allows sending
1069 * an empty address which would force us to rely on just the IRK
1070 * as "identity information". However, since such
1071 * implementations are not known of and in order to not over
1072 * complicate our implementation, simply pretend that we never
1073 * received an IRK for such a device.
1074 */
1075 if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
1076 BT_ERR("Ignoring IRK with no identity address");
4bd6d38e 1077 smp_distribute_keys(conn);
a9a58f86
JH		 1078 return 0;
1079 }
1080
fd349c02
JH		 1081 bacpy(&smp->id_addr, &info->bdaddr);
1082 smp->id_addr_type = info->addr_type;
1083
1084 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
1085 bacpy(&rpa, &hcon->dst);
1086 else
1087 bacpy(&rpa, BDADDR_ANY);
1088
23d0e128
JH		 1089 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
1090 smp->id_addr_type, smp->irk, &rpa);
fd349c02 1091
4bd6d38e 1092 smp_distribute_keys(conn);
fd349c02
JH		 1093
1094 return 0;
1095}
1096
7ee4ea36
MH		 1097static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
1098{
1099 struct smp_cmd_sign_info *rp = (void *) skb->data;
1100 struct smp_chan *smp = conn->smp_chan;
1101 struct hci_dev *hdev = conn->hcon->hdev;
1102 struct smp_csrk *csrk;
1103
1104 BT_DBG("conn %p", conn);
1105
1106 if (skb->len < sizeof(*rp))
38e4a915 1107 return SMP_INVALID_PARAMS;
7ee4ea36
MH		 1108
1109 /* Ignore this PDU if it wasn't requested */
1110 if (!(smp->remote_key_dist & SMP_DIST_SIGN))
1111 return 0;
1112
1113 /* Mark the information as received */
1114 smp->remote_key_dist &= ~SMP_DIST_SIGN;
1115
1116 skb_pull(skb, sizeof(*rp));
1117
1118 hci_dev_lock(hdev);
1119 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1120 if (csrk) {
1121 csrk->master = 0x01;
1122 memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
1123 }
1124 smp->csrk = csrk;
1125 if (!(smp->remote_key_dist & SMP_DIST_SIGN))
1126 smp_distribute_keys(conn);
1127 hci_dev_unlock(hdev);
1128
1129 return 0;
1130}
1131
eb492e01
AB		 1132int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
1133{
7b9899db 1134 struct hci_conn *hcon = conn->hcon;
92381f5c 1135 __u8 code, reason;
eb492e01
AB		 1136 int err = 0;
1137
7b9899db
MH		 1138 if (hcon->type != LE_LINK) {
1139 kfree_skb(skb);
3432711f 1140 return 0;
7b9899db
MH		 1141 }
1142
92381f5c
MH		 1143 if (skb->len < 1) {
1144 kfree_skb(skb);
1145 return -EILSEQ;
1146 }
1147
06ae3314 1148 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
2e65c9d2
AG		 1149 err = -ENOTSUPP;
1150 reason = SMP_PAIRING_NOTSUPP;
1151 goto done;
1152 }
1153
92381f5c 1154 code = skb->data[0];
eb492e01
AB		 1155 skb_pull(skb, sizeof(code));
1156
8cf9fa12
JH		 1157 /*
1158 * The SMP context must be initialized for all other PDUs except
1159 * pairing and security requests. If we get any other PDU when
1160 * not initialized simply disconnect (done if this function
1161 * returns an error).
1162 */
1163 if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
1164 !conn->smp_chan) {
1165 BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
1166 kfree_skb(skb);
1167 return -ENOTSUPP;
1168 }
1169
eb492e01
AB		 1170 switch (code) {
1171 case SMP_CMD_PAIRING_REQ:
da85e5e5 1172 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1173 break;
1174
1175 case SMP_CMD_PAIRING_FAIL:
84794e11 1176 smp_failure(conn, 0);
da85e5e5
VCG		 1177 reason = 0;
1178 err = -EPERM;
eb492e01
AB		 1179 break;
1180
1181 case SMP_CMD_PAIRING_RSP:
da85e5e5 1182 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1183 break;
1184
1185 case SMP_CMD_SECURITY_REQ:
da85e5e5 1186 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1187 break;
1188
eb492e01 1189 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1190 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1191 break;
1192
eb492e01 1193 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1194 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1195 break;
1196
eb492e01 1197 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1198 reason = smp_cmd_encrypt_info(conn, skb);
1199 break;
1200
eb492e01 1201 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1202 reason = smp_cmd_master_ident(conn, skb);
1203 break;
1204
eb492e01 1205 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1206 reason = smp_cmd_ident_info(conn, skb);
1207 break;
1208
eb492e01 1209 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1210 reason = smp_cmd_ident_addr_info(conn, skb);
1211 break;
1212
eb492e01 1213 case SMP_CMD_SIGN_INFO:
7ee4ea36 1214 reason = smp_cmd_sign_info(conn, skb);
7034b911
VCG		 1215 break;
1216
eb492e01
AB		 1217 default:
1218 BT_DBG("Unknown command code 0x%2.2x", code);
1219
1220 reason = SMP_CMD_NOTSUPP;
eb492e01 1221 err = -EOPNOTSUPP;
3a0259bb 1222 goto done;
eb492e01
AB		 1223 }
1224
3a0259bb
VCG		 1225done:
1226 if (reason)
84794e11 1227 smp_failure(conn, reason);
3a0259bb 1228
eb492e01
AB		 1229 kfree_skb(skb);
1230 return err;
1231}
7034b911 1232
35d70271
JH		 1233static void smp_notify_keys(struct l2cap_conn *conn)
1234{
1235 struct smp_chan *smp = conn->smp_chan;
1236 struct hci_conn *hcon = conn->hcon;
1237 struct hci_dev *hdev = hcon->hdev;
53ac6ab6
MH		 1238 struct smp_cmd_pairing *req = (void *) &smp->preq[1];
1239 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
1240 bool persistent;
35d70271 1241
61b1a7fb 1242 if (smp->remote_irk) {
95fbac8a 1243 mgmt_new_irk(hdev, smp->remote_irk);
61b1a7fb
JH		 1244 /* Now that user space can be considered to know the
1245 * identity address track the connection based on it
1246 * from now on.
1247 */
1248 bacpy(&hcon->dst, &smp->remote_irk->bdaddr);
1249 hcon->dst_type = smp->remote_irk->addr_type;
1250 l2cap_conn_update_id_addr(hcon);
1251 }
95fbac8a 1252
53ac6ab6
MH		 1253 /* The LTKs and CSRKs should be persistent only if both sides
1254 * had the bonding bit set in their authentication requests.
1255 */
1256 persistent = !!((req->auth_req & rsp->auth_req) & SMP_AUTH_BONDING);
1257
7ee4ea36
MH		 1258 if (smp->csrk) {
1259 smp->csrk->bdaddr_type = hcon->dst_type;
1260 bacpy(&smp->csrk->bdaddr, &hcon->dst);
53ac6ab6 1261 mgmt_new_csrk(hdev, smp->csrk, persistent);
7ee4ea36
MH		 1262 }
1263
1264 if (smp->slave_csrk) {
1265 smp->slave_csrk->bdaddr_type = hcon->dst_type;
1266 bacpy(&smp->slave_csrk->bdaddr, &hcon->dst);
53ac6ab6 1267 mgmt_new_csrk(hdev, smp->slave_csrk, persistent);
7ee4ea36
MH		 1268 }
1269
35d70271
JH		 1270 if (smp->ltk) {
1271 smp->ltk->bdaddr_type = hcon->dst_type;
1272 bacpy(&smp->ltk->bdaddr, &hcon->dst);
53ac6ab6 1273 mgmt_new_ltk(hdev, smp->ltk, persistent);
35d70271
JH		 1274 }
1275
1276 if (smp->slave_ltk) {
1277 smp->slave_ltk->bdaddr_type = hcon->dst_type;
1278 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
53ac6ab6 1279 mgmt_new_ltk(hdev, smp->slave_ltk, persistent);
35d70271
JH		 1280 }
1281}
1282
4bd6d38e 1283int smp_distribute_keys(struct l2cap_conn *conn)
7034b911
VCG		 1284{
1285 struct smp_cmd_pairing *req, *rsp;
1c1def09 1286 struct smp_chan *smp = conn->smp_chan;
524237cb
JH		 1287 struct hci_conn *hcon = conn->hcon;
1288 struct hci_dev *hdev = hcon->hdev;
7034b911
VCG		 1289 __u8 *keydist;
1290
4bd6d38e 1291 BT_DBG("conn %p", conn);
7034b911 1292
524237cb 1293 if (!test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 1294 return 0;
1295
1c1def09 1296 rsp = (void *) &smp->prsp[1];
7034b911
VCG		 1297
1298 /* The responder sends its keys first */
efabba37 1299 if (hcon->out && (smp->remote_key_dist & 0x07))
7034b911
VCG		 1300 return 0;
1301
1c1def09 1302 req = (void *) &smp->preq[1];
7034b911 1303
524237cb 1304 if (hcon->out) {
7034b911
VCG		 1305 keydist = &rsp->init_key_dist;
1306 *keydist &= req->init_key_dist;
1307 } else {
1308 keydist = &rsp->resp_key_dist;
1309 *keydist &= req->resp_key_dist;
1310 }
1311
7034b911
VCG		 1312 BT_DBG("keydist 0x%x", *keydist);
1313
1314 if (*keydist & SMP_DIST_ENC_KEY) {
1315 struct smp_cmd_encrypt_info enc;
1316 struct smp_cmd_master_ident ident;
23d0e128 1317 struct smp_ltk *ltk;
c9839a11 1318 u8 authenticated;
7034b911 1319 __le16 ediv;
fe39c7b2 1320 __le64 rand;
7034b911
VCG		 1321
1322 get_random_bytes(enc.ltk, sizeof(enc.ltk));
1323 get_random_bytes(&ediv, sizeof(ediv));
fe39c7b2 1324 get_random_bytes(&rand, sizeof(rand));
7034b911
VCG		 1325
1326 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
1327
c9839a11 1328 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
524237cb 1329 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
35d70271 1330 HCI_SMP_LTK_SLAVE, authenticated, enc.ltk,
fe39c7b2 1331 smp->enc_key_size, ediv, rand);
23d0e128 1332 smp->slave_ltk = ltk;
16b90839 1333
58115373 1334 ident.ediv = ediv;
fe39c7b2 1335 ident.rand = rand;
7034b911
VCG		 1336
1337 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
1338
1339 *keydist &= ~SMP_DIST_ENC_KEY;
1340 }
1341
1342 if (*keydist & SMP_DIST_ID_KEY) {
1343 struct smp_cmd_ident_addr_info addrinfo;
1344 struct smp_cmd_ident_info idinfo;
1345
863efaf2 1346 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
7034b911
VCG		 1347
1348 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
1349
82d4b359
JH		 1350 /* The hci_conn contains the local identity address
1351 * after the connection has been established.
1352 *
1353 * This is true even when the connection has been
1354 * established using a resolvable random address.
1355 */
524237cb 1356 bacpy(&addrinfo.bdaddr, &hcon->src);
82d4b359 1357 addrinfo.addr_type = hcon->src_type;
7034b911
VCG		 1358
1359 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
f1560463 1360 &addrinfo);
7034b911
VCG		 1361
1362 *keydist &= ~SMP_DIST_ID_KEY;
1363 }
1364
1365 if (*keydist & SMP_DIST_SIGN) {
1366 struct smp_cmd_sign_info sign;
7ee4ea36 1367 struct smp_csrk *csrk;
7034b911 1368
7ee4ea36 1369 /* Generate a new random key */
7034b911
VCG		 1370 get_random_bytes(sign.csrk, sizeof(sign.csrk));
1371
7ee4ea36
MH		 1372 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1373 if (csrk) {
1374 csrk->master = 0x00;
1375 memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
1376 }
1377 smp->slave_csrk = csrk;
1378
7034b911
VCG		 1379 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1380
1381 *keydist &= ~SMP_DIST_SIGN;
1382 }
1383
efabba37
JH		 1384 /* If there are still keys to be received wait for them */
1385 if ((smp->remote_key_dist & 0x07))
1386 return 0;
1387
1d98bf4f
JH		 1388 clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags);
1389 cancel_delayed_work_sync(&conn->security_timer);
1390 set_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
1391 smp_notify_keys(conn);
efabba37 1392
1d98bf4f 1393 smp_chan_destroy(conn);
d26a2345 1394
7034b911
VCG		 1395 return 0;
1396}
Linux kernel - Deliverables
This page took 0.23149 seconds and 5 git commands to generate.